What leaked was not a password list

What the record says

Have I Been Pwned is the primary source here — the registry security researcher Troy Hunt runs, and the reference other reporting cites.

The registry's own description, quoted rather than paraphrased:

> The “AI girlfriend” platform Muah.AI experienced a security incident that exposed nearly 2 million email addresses along with user-generated prompts for creating AI images. “Many of the prompts were highly sexual in nature, with many also describing child exploitation scenarios.”

We are quoting because this is one of those cases where summarising in our own words would either soften it or sensationalise it, and both would be wrong.

Why “sensitive” matters more than the number

The 1.9 million is the headline. The word *sensitive* is the more important part of the record.

Most breaches in Have I Been Pwned are publicly searchable: type an address, find out if it appeared. A sensitive breach is removed from that search entirely. You can only check your own address, and only by verifying that you control it — the email-verification route rather than the search box.

That setting exists for a specific reason: it is applied when belonging to a service is itself capable of harming someone. Not when the data is embarrassing, but when the mere fact of having an account could cost a person their job, their relationship, or their safety if a stranger could look it up.

The flag was designed for dating sites and affair services, years before anyone built a product that stores what you asked an image model to draw. This category is barely three years old, and the tools for handling its failures were built for something else.

Applying it means the registry judged that the risk of letting anyone check whether you had a Muah AI account outweighed the benefit of easy searching. That is a deliberate restriction of a public safety tool, and it is not applied often.

The difference between theft and identification

Here is the practical distinction that most coverage misses.

A password breach is a theft problem. Someone might get into your accounts. The fix is mechanical: change credentials, enable two-factor, move on. Unpleasant, bounded, solvable.

A prompt breach is an identification problem. Nothing needs to be broken into. The harm is that a specific person is now attached to specific text they wrote in private, and there is no action that undoes it. You cannot rotate the fact that an address of yours appeared next to something you typed.

This is why the standard advice — change your password — is technically correct and almost beside the point. It is also why courts have started treating these products as products rather than as neutral pipes: the design is the thing that failed, and design is something a company chooses.

If you think you were affected

The useful steps, in order.

1. Check at haveibeenpwned.com, using the email-verification route. Because the breach is flagged sensitive, the ordinary search box will not tell you. You will be asked to prove you control the address, and the result comes by email. The restriction is there to protect you, not to obstruct you.
2. Change any password you reused elsewhere. Not because passwords were the exposure here, but because reuse is how one incident becomes several.
3. Treat unsolicited messages referencing the service as extortion attempts, not as proof. Sextortion mail that cites a real breach is a known pattern, and the sender almost never has what they claim. Data being public means anyone can reference it; it does not mean they have your file.
4. Do not pay anyone, and do not reply. A reply confirms the address is live, which is the only thing the sender actually learns.
5. Assume the data stays out. Nothing the company does now retrieves it. If you used the service before September 2024 with an address you still use, that pairing exists in copies you cannot reach.

The general lesson costs nothing and applies to every service in this category: use an address that is not tied to your name, and never reuse a password. Two of the products we cover let you start without an email at all — we compare what each free tier actually gives you, with the real limits rather than the advertised ones.

What we could not find out

This section exists because it is part of the story.

The site does not answer automated requests. Muah AI returns HTTP 403 to anything that looks like a crawler. That is a legitimate anti-scraping measure and plenty of sites do it. It also means the pricing page, the terms of service and the identity of the operating company could not be read at source. We do not publish figures we cannot verify, so our review of this service says the price is unpublished rather than repeating a number from somewhere else.

There is no public post-mortem. After an incident of this scale, a security write-up is the normal thing to publish: what happened, what was exposed, what changed afterwards. We could not find one. If it exists, it is not where a reader would look.

The app store position is unclear. The Google Play listing responds normally — *Muah AI: AI Girlfriend Chat*, package `com.muahaichat.app`. The App Store listing gave contradictory responses when checked, so we do not claim it is there and we do not claim it was removed.

Three unknowns about a service that lost two million people's private text. That combination is the finding, not a footnote to it.

Why there is no affiliate link on that page

Every review on this site can earn us a commission. That is disclosed in full, and it is the only way the site is funded.

There is no affiliate link to Muah AI anywhere, and the reason is the sentence quoted above from the breach registry. We decided that before writing the page rather than after, and the page says so in the text rather than in a footnote.

We mention this not as a virtue display but because it is checkable: open the review, look for a button, notice there is not one. It is the single clearest test of whether a comparison site's incentives are steering its recommendations, and we would rather point at it than describe it.

What this says about the rest of the category

The uncomfortable part is that Muah AI is not structurally unusual. Every service in this category holds the same class of data: an address, and a record of what a person asked for in private. The difference between them is not what they store — it is what happens to it.

Which makes three questions worth asking of any of them, before you type anything you would not want attached to your name:

• Does the provider say whether conversations are used for training? Some do, clearly. Others are silent, and silence is an answer.
• Can you find out who the company is? A registered name, a country, a jurisdiction. If the terms and the app store name different entities — and for one product on our list they do — you do not know who holds your data.
• Is there a way to delete an account and its history, and is it documented? Not a support ticket. A documented route.

None of this is exotic diligence. It is the same check anyone does before giving a card number to an unfamiliar shop, applied to something more personal than a card number.

The regulators reached the same conclusion by a different road. Italy fined Replika's operator five million euros in May 2025 partly for having no age verification and a privacy policy that did not say enough. In the United States the reckoning came through the courts instead.

If you are choosing between services now, our ranking of The Best AI Girlfriend Apps of 2026 weighs price, free limits, memory and media.

It does not score security, and it never will, because there is no honest way to grade something you cannot audit from outside. The Muah AI case is exactly why we say that on the methodology page rather than inventing a number for it.

What you can control is what you attach to it. An address that is not your name, a password used nowhere else, and the assumption that anything typed into any of these products could one day be read by someone else. That assumption cost 1.9 million people nothing to make and would have saved them a great deal.